Post

Scoop: The lone employee behind CISA's Pre-Ransomware Notification Initiative resigned on Friday rather than take a forced reassignment to FEMA. CISA says PRNI will continue, but sources said David Stern's loss will be a major setback for it. My story: www.cybersecuritydive.com/news/cisa-ra...

The PRNI, which launched in late 2022, is one of the most tactile ways in which CISA helps protect critical infrastructure organizations. When CISA gets intelligence from a partner about hackers prepping ransomware activity on a victim network, it alerts the victim.

In an interview with the SANS Institute in August, Stern said the PRNI had delivered 4,300 warnings — including some to foreign governments about targeted companies in their countries — and saved victims roughly $9 billion in economic damages.

But shortly before the government shutdown began, Stern received one of DHS's Management Directed Reassignments (www.cybersecuritydive.com/news/cisa-la...), ordering him to take a FEMA job in Boston. He fought it for months but was eventually told to move or leave. So he quit on Friday.

In a statement, CISA said the PRNI "has not stopped" and added that the agency continues to focus "squarely on executing its statutory mission," including "delivering timely, actionable cyber threat intelligence" to partners.

The PRNI may indeed still be operating. One source told me that CISA was preparing other employees to take over for Stern. But multiple sources said Stern brought unique value to the program that won't easily be replaced — potentially hampering it in the short term.